When you add your Gmail or Yahoo account to the new Outlook, Microsoft sends your email password to their servers. Not a hash — the actual password. Verified by security researchers. Microsoft designed it this way on purpose. Russian military hackers used an Outlook vulnerability to steal credentials — just receiving an email was enough, you didn't even have to open it. Another bug meant just looking at your inbox in preview mode could give attackers full control of your computer.
What they claim: Microsoft positions Outlook as a professional email solution for work and personal use
What we found: Copilot AI integration reads email content across all Outlook accounts. In January-February 2026, Copilot was caught reading confidential emails for weeks before the issue was identified. Microsoft shares data with 801 advertising partners. Free Outlook shows ads that cannot be fully disabled. 31% of US government demands come with secrecy orders — Microsoft can't tell you they handed over your email.
What they claim: Microsoft's new Outlook app is presented as an upgrade to Windows Mail
What we found: The new Outlook sends your IMAP and SMTP credentials — including passwords — for third-party email accounts (Gmail, Yahoo, iCloud) to Microsoft's Azure servers. Verified by c't/heise via traffic analysis in November 2023. When you add your Gmail account to Outlook, Microsoft gets your Gmail password. This is not a bug — it's the architecture.
What they claim: Outlook is marketed as a secure, trusted email client from Microsoft
What we found: CVE-2023-23397 (CVSS 9.8): Russian military intelligence (APT28) exploited Outlook to steal NTLM credentials via a specially crafted email — no user interaction required, just receiving the email was enough. CVE-2025-21298 (CVSS 9.8): zero-click RCE via the preview pane. Opening Outlook and looking at your inbox was enough to be compromised.
What they claim: Microsoft forced Windows Mail users to migrate to the new Outlook in December 2024
What we found: Users had no choice — Windows Mail was discontinued and replaced by new Outlook. The migration sent existing email configurations, including third-party account credentials, to Microsoft's cloud. Users who had been using a local-only email client were silently moved to a cloud-dependent one that sends their passwords to Azure.
What they claim: Microsoft claims enterprise-grade security for Outlook
What we found: Microsoft was the first PRISM participant in September 2007. In H1 2025, Microsoft received 6,288 US legal demands for consumer data. 1,974 of these came with secrecy orders — the user was never told. The German Federal Data Protection Commissioner responded to the credential forwarding issue but Microsoft did not change the architecture.